From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.5 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_PASS,USER_AGENT_MUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 17F4DC282D8 for ; Fri, 1 Feb 2019 14:44:04 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D0F05218FC for ; Fri, 1 Feb 2019 14:44:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1549032243; bh=kXu17uLIHK2A+I7RmMcaUx89RSQU49q6Ln/tXfN2nXU=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=qpzHImmqa0UqtmxR6Vgd3rnxs9Q3oC+r7b+s6LRvvsUCNO97fVw/afe+oDFZmM8kh ffzMLMQytCDCVeeu6CuIfnr7r5WGSuY1VY5VnRyhvtuO3mMvwx1eKjnlkQFfieNaH7 QmhUmgjgtd0saLSW/2dVrNVp5JBpWaGxhZ0X9r1k= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728357AbfBAOoD (ORCPT ); Fri, 1 Feb 2019 09:44:03 -0500 Received: from mail.kernel.org ([198.145.29.99]:32920 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725780AbfBAOoD (ORCPT ); Fri, 1 Feb 2019 09:44:03 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DFA3020870; Fri, 1 Feb 2019 14:44:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1549032242; bh=kXu17uLIHK2A+I7RmMcaUx89RSQU49q6Ln/tXfN2nXU=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=hxG5CKmCedcEYBTDL9SPOQ3tqZVAHCvJ2CZKHy/tEIbc7xrEE2Shd4PDgkY6upYVw WoA9ZeOcZ+t7wGyCLQaIznNpEJwKFL+yuEyk0dPTR1gxUCC/pD4xvp78nhRGCA9yTI wmlQrdiEpou7SPZHFZz5Z5aFQCBgz6jKiPP89K0I= Date: Fri, 1 Feb 2019 15:43:59 +0100 From: Greg Kroah-Hartman To: Marcelo Ricardo Leitner Cc: Vlad Yasevich , Neil Horman , linux-sctp@vger.kernel.org, netdev@vger.kernel.org, vuln@secunia.com Subject: Re: [PATCH net] sctp: walk the list of asoc safely Message-ID: <20190201144359.GA9864@kroah.com> References: <20190201141522.GA20785@kroah.com> <20190201142037.GC10521@localhost.localdomain> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20190201142037.GC10521@localhost.localdomain> User-Agent: Mutt/1.11.2 (2019-01-07) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Fri, Feb 01, 2019 at 12:20:37PM -0200, Marcelo Ricardo Leitner wrote: > On Fri, Feb 01, 2019 at 03:15:22PM +0100, Greg Kroah-Hartman wrote: > > In sctp_sendmesg(), when walking the list of endpoint associations, the > > association can be dropped from the list, making the list corrupt. > > Properly handle this by using list_for_each_entry_safe() > > > > Fixes: 4910280503f3 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg") > > Reported-by: Secunia Research > > Tested-by: Secunia Research > > Signed-off-by: Greg Kroah-Hartman > > > > diff --git a/net/sctp/socket.c b/net/sctp/socket.c > > index f93c3cf9e567..65d6d04546ae 100644 > > --- a/net/sctp/socket.c > > +++ b/net/sctp/socket.c > > @@ -2027,7 +2027,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) > > struct sctp_endpoint *ep = sctp_sk(sk)->ep; > > struct sctp_transport *transport = NULL; > > struct sctp_sndrcvinfo _sinfo, *sinfo; > > - struct sctp_association *asoc; > > + struct sctp_association *asoc, *tmp; > > struct sctp_cmsgs cmsgs; > > union sctp_addr *daddr; > > bool new = false; > > @@ -2053,7 +2053,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) > > Extending the context here by 1 line: > lock_sock(sk); > > > > /* SCTP_SENDALL process */ > > if ((sflags & SCTP_SENDALL) && sctp_style(sk, UDP)) { > > - list_for_each_entry(asoc, &ep->asocs, asocs) { > > + list_for_each_entry_safe(asoc, tmp, &ep->asocs, asocs) { > > With the socket being locked by here, how can an asoc be removed > while the list is being traversed? The socket lock should be > protecting from it. What about when the SCTP_ABORT flag is set with SCTP_SENDALL at the same time? :(